Malicious PDF — malware analysis report

Static analysis result for SHA-256 c42323f975d500a9…

MALICIOUS

PDF

63.4 KB Created: 2020-08-15 12:26:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 01d9bfc7edf7b2ceaa5f174f0fdf7c2f SHA-1: 1ed3fbaf597aab46ad4c39d8b651b82d64bfb057 SHA-256: c42323f975d500a912a53f8f1f65cd83c58a80c73b77c66889eee8cc6e53d47e
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link farm designed to mimic search results, directing users to a malicious redirector at 'ttraff.ru'. This is a common tactic for SEO poisoning to lure victims into downloading further malware or visiting phishing sites. The ML classifier strongly indicated maliciousness, and the presence of numerous external links supports the SEO link farm heuristic.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wb?keyword=rscit%20question%20paper%202016%20pdf
    • http://files.cuastt.com/uploads/1/3/2/6/132695749/7885266.pdf
    • http://files.dhshighschool.com/uploads/1/3/1/4/131438611/tejokufum.pdf
    • https://cdn.shopify.com/s/files/1/0432/2613/6743/files/40438161216.pdf
    • https://cdn.shopify.com/s/files/1/0430/2359/7725/files/71704738596.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/livoxigugefeguvon.pdf
    • https://cdn.shopify.com/s/files/1/0428/4914/0902/files/peguruginowogavupanoz.pdf
    • https://cdn.shopify.com/s/files/1/0430/5174/5442/files/33243808582.pdf
    • https://cdn.shopify.com/s/files/1/0431/9769/4109/files/tagefisek.pdf
    • https://cdn.shopify.com/s/files/1/0438/2146/5757/files/68170931845.pdf
    • https://cdn.shopify.com/s/files/1/0436/1682/9603/files/rugikumanu.pdf
    • https://cdn.shopify.com/s/files/1/0431/8894/5064/files/46577382788.pdf
    • https://cdn.shopify.com/s/files/1/0429/8512/8099/files/62349521280.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000069ac.bin
40b5f6059f3638091b78473953dd64549445aa0ed0d4d84470959c754c3a7a91		 pdf-font-stream PDF embedded font (sfnt) at offset 0x69AC 5612 bytes
font_01_sfnt_off00007cc2.bin
d0c9e33916e9e64e42e31bcf0d345f6c2fcd41735b1a34df0119bd0eb1094281		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7CC2 3720 bytes
font_02_sfnt_off0000881e.bin
ff21e803e22997365e39de14ea7ed54d4a4ac9993e344bd01ee66858119c9d93		 pdf-font-stream PDF embedded font (sfnt) at offset 0x881E 3876 bytes
font_03_sfnt_off0000974a.bin
904ea2fc7fb2866715b8a13e0a88a3702829fb29103561abd1f89f99b4a6ffd9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x974A 12556 bytes
font_04_sfnt_off0000bf7e.bin
cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34		 pdf-font-stream PDF embedded font (sfnt) at offset 0xBF7E 4324 bytes
font_05_sfnt_off0000cd81.bin
b66eb7c6a303b1011fd1278daf78bacd0e592a2b338012e8132d7e3c4051d404		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCD81 11036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.